Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a4c3f89c authored by John Johansen's avatar John Johansen
Browse files

apparmor: fixup secid map conversion to using IDR 



The IDR conversion did not handle an error case for when allocating a
mapping fails, and it did not ensure that mappings did not allocate or
use a 0 value, which is used as an invalid secid. Which is used when a
mapping fails.

Fixes: 3ae7eb49a2be ("apparmor: Use an IDR to allocate apparmor secids")
Signed-off-by: default avatarJohn Johansen <john.johansen@canonical.com>
parent 99cc45e4

security/apparmor/include/secid.h

+3 −1
Original line number Diff line number Diff line
@@ -28,8 +28,10 @@ int apparmor_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid); 
void apparmor_release_secctx(char *secdata, u32 seclen);





u32 aa_alloc_secid(struct aa_label *label, gfp_t gfp);

int aa_alloc_secid(struct aa_label *label, gfp_t gfp);

void aa_free_secid(u32 secid);

void aa_secid_update(u32 secid, struct aa_label *label);



void aa_secids_init(void);



#endif /* __AA_SECID_H */

security/apparmor/label.c

+1 −2
Original line number Diff line number Diff line
@@ -407,8 +407,7 @@ bool aa_label_init(struct aa_label *label, int size, gfp_t gfp) 
	AA_BUG(!label);

	AA_BUG(size < 1);



	label->secid = aa_alloc_secid(label, gfp);

	if (label->secid == AA_SECID_INVALID)

	if (aa_alloc_secid(label, gfp) < 0)

		return false;



	label->size = size;			/* doesn't include null */

security/apparmor/lsm.c

+2 −0
Original line number Diff line number Diff line
@@ -1547,6 +1547,8 @@ static int __init apparmor_init(void) 
		return 0;

	}



	aa_secids_init();



	error = aa_setup_dfa_engine();

	if (error) {

		AA_ERROR("Unable to setup dfa engine\n");

security/apparmor/secid.c

+23 −5
Original line number Diff line number Diff line
@@ -33,6 +33,8 @@ 
 * properly updating/freeing them

 */



#define AA_FIRST_SECID 1



static DEFINE_IDR(aa_secids);

static DEFINE_SPINLOCK(secid_lock);
@@ -120,20 +122,31 @@ void apparmor_release_secctx(char *secdata, u32 seclen) 


/**

 * aa_alloc_secid - allocate a new secid for a profile

 * @label: the label to allocate a secid for

 * @gfp: memory allocation flags

 *

 * Returns: 0 with @label->secid initialized

 *          <0 returns error with @label->secid set to AA_SECID_INVALID

 */

u32 aa_alloc_secid(struct aa_label *label, gfp_t gfp)

int aa_alloc_secid(struct aa_label *label, gfp_t gfp)

{

	unsigned long flags;

	u32 secid;

	int ret;



	idr_preload(gfp);

	spin_lock_irqsave(&secid_lock, flags);

	secid = idr_alloc(&aa_secids, label, 0, 0, GFP_ATOMIC);

	/* XXX: Can return -ENOMEM */

	ret = idr_alloc(&aa_secids, label, AA_FIRST_SECID, 0, GFP_ATOMIC);

	spin_unlock_irqrestore(&secid_lock, flags);

	idr_preload_end();



	return secid;

	if (ret < 0) {

		label->secid = AA_SECID_INVALID;

		return ret;

	}



	AA_BUG(ret == AA_SECID_INVALID);

	label->secid = ret;

	return 0;

}



/**
@@ -148,3 +161,8 @@ void aa_free_secid(u32 secid) 
	idr_remove(&aa_secids, secid);

	spin_unlock_irqrestore(&secid_lock, flags);

}



void aa_secids_init(void)

{

	idr_init_base(&aa_secids, AA_FIRST_SECID);

}